Windows Kernel CVE-2026-50436

Exploitation requires the attacker to already have local, authenticated access with the ability to run code on the target (PR:L, AV:L) - this is a privilege-escalation bug, not a remote entry point. No user interaction is required (UI:N) and attack complexity is low (AC:L), so no special timing, race window, or non-default configuration is called out in the available data beyond running on an affected build. The limiting factors are therefore the need for prior local access and for the host to be one of the affected platforms (Windows 11 24H2/25H2/26H1 or Windows Server 2025); remote or unauthenticated attackers cannot trigger this directly.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is internally consistent with the description: local attack vector, low complexity, low privileges required (a standard authenticated user), no user interaction, unchanged scope, and full compromise of the local system. This is a real but not top-tier priority - it is not a remote or unauthenticated vector, so it functions as a post-compromise escalation step rather than an initial access vector. No EPSS score was provided, it is not in CISA KEV, and no proof-of-concept was reported, so there is no signal of active or imminent exploitation, and no SSVC decision data was supplied. The primary risk is that use-after-free EoP bugs are attractive and historically reliable targets for attackers who already hold a foothold (malware, phishing payloads, or a compromised low-privilege account) seeking SYSTEM. Absent exploitation signals, standard Patch Tuesday prioritization is appropriate, elevated on multi-user or shared hosts where untrusted users can run code.

An attacker who has already gained low-privileged code execution on a Windows 11 or Windows Server 2025 host - for example via a phishing payload or a compromised standard user account - runs a crafted program that manipulates the vulnerable kernel object to trigger the use-after-free. By controlling the freed-then-reallocated memory, the attacker corrupts kernel structures to gain arbitrary read/write and elevates to SYSTEM. No public proof-of-concept has been reported, but the low attack complexity makes reliable exploitation plausible once a technique is developed.